Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About fzfeng
fzfeng
New Member
Member since:
04-16-2018
06-05-2020
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-16-2018 |
Activity Feed
- Posted Re: how to display time rightly in csv file on Splunk Search. 04-24-2018 12:48 AM
- Posted Re: how to display time rightly in csv file on Splunk Search. 04-24-2018 12:32 AM
- Posted how to display _time on Splunk Search. 04-23-2018 10:54 PM
- Tagged how to display _time on Splunk Search. 04-23-2018 10:54 PM
- Posted how to display time rightly in csv file on Splunk Search. 04-23-2018 10:45 PM
- Tagged how to display time rightly in csv file on Splunk Search. 04-23-2018 10:45 PM
- Posted Re: the max time of day on Splunk Search. 04-20-2018 06:16 PM
- Posted Re: how to select from table on Dashboards & Visualizations. 04-20-2018 04:38 AM
- Posted Re: how to select from table on Dashboards & Visualizations. 04-19-2018 01:15 AM
- Posted Re: how to select from table on Dashboards & Visualizations. 04-19-2018 12:33 AM
- Posted Re: how to select from table on Dashboards & Visualizations. 04-18-2018 01:50 AM
- Posted Re: how to select from table on Dashboards & Visualizations. 04-18-2018 12:38 AM
- Posted Re: how to select from table on Dashboards & Visualizations. 04-18-2018 12:31 AM
- Posted how to put the result of search into a new index on Getting Data In. 04-18-2018 12:16 AM
- Tagged how to put the result of search into a new index on Getting Data In. 04-18-2018 12:16 AM
- Posted Re: how to select from table on Dashboards & Visualizations. 04-17-2018 11:49 PM
- Posted Re: how to select from table on Dashboards & Visualizations. 04-17-2018 11:33 PM
- Posted Re: how to select from table on Dashboards & Visualizations. 04-17-2018 09:47 PM
- Posted how to select from table on Dashboards & Visualizations. 04-17-2018 06:11 PM
- Tagged how to select from table on Dashboards & Visualizations. 04-17-2018 06:11 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-24-2018
12:32 AM
thank you I tried it
and i set the time range one month
the graph it displaied 3/27 3/29 3/31 4/2 4/4 .....
but the table displaied 3/37 3/28 3/29 3/31 4/1 4/2 ....
... View more
04-23-2018
10:54 PM
hello
I have tow problems
1 I export my search result to csv file
but when I open it the time just display like this
1.52E+09 how to do if I want time to display right
index=maillog I timechart span=1d，count（eval（IP=×××）） as IP1 I outputcsv IP1
2 I use this command to count the IP
but in my column chart the interval is not one day
_time display like this 3/25 3/27 3/29
how to set it like 3/25 3/26 3/27 3/28 3/29
thanks
... View more
- Tags:
- splunk-enterprise
04-23-2018
10:45 PM
hello
I export my search result to csv file
but when I open it the time just display like this
1.52E+09
index=maillog I timechart span=1d，count（eval（IP=×××）） as IP1 I outputcsv IP1
... View more
- Tags:
- splunk-enterprise
04-18-2018
01:50 AM
hello thanks very much
but I also have one problem
base on the command you show me please see the table
_time HourlyCount Maxcount
2018/4/15 00：00 I 85 I 1084
2018/4/15 01：00 I 84 I 1084
2018/4/15 03：00 I 86 I 1084
2018/4/15 04：00 I 89 I 1084
2018/4/15 05：00 I 90 I 1084
2018/4/15 06：00 I 95 I 1084
2018/4/15 07：00 I 1084 I 1084
2018/4/15 08：00 I 85 I 1084
2018/4/15 09：00 I 85 I 1084
2018/4/15 10：00 I 85 I 1084
2018/4/15 11：00 I 85 I 1084
how can I just get only
2018/4/15 07：00 I 1084 I 1084
the other days are same
thank you
... View more
04-18-2018
12:38 AM
with this you get
_time |count
2018/4/11 09：00 | 8
2018/4/11 10：00 | 58
2018/4/12 11：00 | 6
2018/4/12 12：00 | 12
from this table
I want to get
2018/4/11 10：00 58
2018/4/12 12：00 12
... View more
04-18-2018
12:31 AM
thank you so much
I want the max count of hour
like this
time I maxcount
2018-4-11 10：00 I 58
2018-4-12 11：00 I 12
like this
2018-4-11 09：00 50
2018-4-11 10：00 60
2018-4-11 11：00 70
2018-4-12 15：00 55
2018-4-12 16：00 56
I just want get the max count item
so how can I do just get
2018-4-11 11：00 70
2018-4-12 16：00 56
thanks for your
... View more
04-18-2018
12:16 AM
hello
I want to use this search index=maillog I transaction qid maxspan=1m maxpause=30s and put the result into a new index how to set it
thank you
... View more
- Tags:
- splunk-enterprise
04-17-2018
11:33 PM
thank you
maybe my explain is poor
I want to make a statistic table base on mailog of Outlook
the information I want to get from mailog is value of mail per hour and I just want the only one max value per hour of a day
the table will be like
time max_count
2018-4-12 9：00 6
2018-4-13 20：00 7
I donot know if you get it
sorry
... View more
04-17-2018
09:47 PM
thanks for helping me
but it doesnot work
index I timechart span=1h count I bin _time as day span=1d I eventsstats max（count）as maxcount by day I where count=maxcount I sort 0 _time
I tried but I cannot get the only one item of everyday
... View more
04-17-2018
06:11 PM
hello
I made a search like this
index=IP1 I timechart span=1h count and I set the date one week
so I got this table
time count
2018/4/11 09：00 8
2018/4/11 10：00 58
2018/4/11 11：00 6
2018/4/11 12：00 2
2018/4/11 13：00 8
……
2018/4/12 00：00 8
2018/4/12 01：00 10
2018/4/12 02：00 8
……
2018/4/13 09：00 8
2018/4/13 10：00 5
how can I get the max value of everyday and the table will be like this
2018/4/11 10：00 58
2018/4/12 01：00 10
2018/4/13 09：00 8
thanks every much
please help me one more time
... View more
- Tags:
- splunk-enterprise
04-16-2018
12:52 AM
hello guys
I want to make a pie chart of mail size for one mouth
if my record is wrong？
index=maillog I stats count （eval（size＜1024））as count1 ，count（eval（size＞1024 and size＜2048））
as count2，count（eval（size＜1024）））as count3
if you know it can you tell me thanks
... View more
- Tags:
- splunk-enterprise
04-16-2018
12:33 AM
hello everybody I have one problem
I want to know how to mark the time of the most counts on my graph
index=mailog IP1 I timechart apan=1h count I timechart span=1d max（count）as count 1
4 /13 2018 was displayied but there is no hour
thanks everybody
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
